gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-30 23:50:25 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['.github/pull_request_template.md', 'src/pentesting-cloud/az

Browse Source
This commit is contained in:
Translator
2024-12-31 19:02:02 +00:00
parent 7770a50092
commit 2753c75e8b
244 changed files with 8471 additions and 11302 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/azure-security/az-services/az-azuread.md
+202 -274
View File
@@ -2,19 +2,18 @@
{{#include ../../../banners/hacktricks-training.md}}
## Basic Information
## Basiese Inligting
Azure Active Directory (Azure AD) serves as Microsoft's cloud-based service for identity and access management. It is instrumental in enabling employees to sign in and gain access to resources, both within and beyond the organization, encompassing Microsoft 365, the Azure portal, and a multitude of other SaaS applications. The design of Azure AD focuses on delivering essential identity services, prominently including **authentication, authorization, and user management**.
Azure Active Directory (Azure AD) dien as Microsoft se wolk-gebaseerde diens vir identiteit en toegang bestuur. Dit is noodsaaklik om werknemers in staat te stel om aan te meld en toegang te verkry tot hulpbronne, beide binne en buite die organisasie, insluitend Microsoft 365, die Azure-portaal, en 'n menigte ander SaaS-toepassings. Die ontwerp van Azure AD fokus op die lewering van noodsaaklike identiteit dienste, wat prominent **authentisering, autorisasie, en gebruikersbestuur** insluit.
Key features of Azure AD involve **multi-factor authentication** and **conditional access**, alongside seamless integration with other Microsoft security services. These features significantly elevate the security of user identities and empower organizations to effectively implement and enforce their access policies. As a fundamental component of Microsoft's cloud services ecosystem, Azure AD is pivotal for the cloud-based management of user identities.
Belangrike kenmerke van Azure AD sluit **multi-faktor authentisering** en **voorwaardelike toegang** in, tesame met naatlose integrasie met ander Microsoft sekuriteitsdienste. Hierdie kenmerke verhoog die sekuriteit van gebruikersidentiteite aansienlik en bemagtig organisasies om hul toegangbeleide effektief te implementeer en af te dwing. As 'n fundamentele komponent van Microsoft se wolkdienste-ekosisteem, is Azure AD van kardinale belang vir die wolk-gebaseerde bestuur van gebruikersidentiteite.
## Enumeration
## Enumerasie
### **Connection**
### **Verbinding**
{{#tabs }}
{{#tab name="az cli" }}
```bash
az login #This will open the browser (if not use --use-device-code)
az login -u <username> -p <password> #Specify user and password
@@ -43,11 +42,9 @@ az find "vm" # Find vm commands
az vm -h # Get subdomains
az ad user list --query-examples # Get examples
```
{{#endtab }}
{{#tab name="Mg" }}
```powershell
# Login Open browser
Connect-MgGraph
@@ -72,11 +69,9 @@ Connect-MgGraph -AccessToken $secureToken
# Find commands
Find-MgGraphCommand -command *Mg*
```
{{#endtab }}
{{#tab name="Az PowerShell" }}
```powershell
Connect-AzAccount #Open browser
# Using credentials
@@ -98,7 +93,7 @@ Connect-AzAccount -AccessToken $token -GraphAccessToken $graphaccesstoken -Accou
# Connect with Service principal/enterprise app secret
$password = ConvertTo-SecureString 'KWEFNOIRFIPMWL.--DWPNVFI._EDWWEF_ADF~SODNFBWRBIF' -AsPlainText -Force
$creds = New-Object
System.Management.Automation.PSCredential('2923847f-fca2-a420-df10-a01928bec653', $password)
System.Management.Automation.PSCredential('2923847f-fca2-a420-df10-a01928bec653', $password)
Connect-AzAccount -ServicePrincipal -Credential $creds -Tenant 29sd87e56-a192-a934-bca3-0398471ab4e7d
#All the Azure AD cmdlets have the format *-AzAD*
@@ -106,33 +101,29 @@ Get-Command *azad*
#Cmdlets for other Azure resources have the format *Az*
Get-Command *az*
```
{{#endtab }}
{{#tab name="Raw PS" }}
{{#tab name="Rawe PS" }}
```powershell
#Using management
$Token = 'eyJ0eXAi..'
# List subscriptions
$URI = 'https://management.azure.com/subscriptions?api-version=2020-01-01'
$RequestParams = @{
Method = 'GET'
Uri = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
Method = 'GET'
Uri = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
}
(Invoke-RestMethod @RequestParams).value
# Using graph
Invoke-WebRequest -Uri "https://graph.windows.net/myorganization/users?api-version=1.6" -Headers @{Authorization="Bearer {0}" -f $Token}
```
{{#endtab }}
{{#tab name="curl" }}
```bash
# Request tokens to access endpoints
# ARM
@@ -141,11 +132,9 @@ curl "$IDENTITY_ENDPOINT?resource=https://management.azure.com&api-version=2017-
# Vault
curl "$IDENTITY_ENDPOINT?resource=https://vault.azure.net&api-version=2017-09-01" -H secret:$IDENTITY_HEADER
```
{{#endtab }}
{{#tab name="Azure AD" }}
```powershell
Connect-AzureAD #Open browser
# Using credentials
@@ -157,57 +146,52 @@ Connect-AzureAD -Credential $creds
## AzureAD cannot request tokens, but can use AADGraph and MSGraph tokens to connect
Connect-AzureAD -AccountId test@corp.onmicrosoft.com -AadAccessToken $token
```
{{#endtab }}
{{#endtabs }}
When you **login** via **CLI** into Azure with any program, you are using an **Azure Application** from a **tenant** that belongs to **Microsoft**. These Applications, like the ones you can create in your account, **have a client id**. You **won't be able to see all of them** in the **allowed applications lists** you can see in the console, **but they are allowed by default**.
Wanneer jy **aanmeld** via **CLI** in Azure met enige program, gebruik jy 'n **Azure-toepassing** van 'n **tenant** wat aan **Microsoft** behoort. Hierdie Toepassings, soos die wat jy in jou rekening kan skep, **het 'n kliënt-id**. Jy **sal nie al hulle kan sien nie** in die **toegelate toepassingslys** wat jy in die konsole kan sien, **maar hulle is standaard toegelaat**.
For example a **powershell script** that **authenticates** use an app with client id **`1950a258-227b-4e31-a9cf-717495945fc2`**. Even if the app doesn't appear in the console, a sysadmin could **block that application** so users cannot access using tools that connects via that App.
However, there are **other client-ids** of applications that **will allow you to connect to Azure**:
Byvoorbeeld, 'n **powershell-skrip** wat **autentiseer** gebruik 'n app met kliënt-id **`1950a258-227b-4e31-a9cf-717495945fc2`**. Selfs al verskyn die app nie in die konsole nie, kan 'n stelselaanvoerder **daardie toepassing blokkeer** sodat gebruikers nie toegang kan verkry nie met gereedskap wat via daardie App verbind.
Daar is egter **ander kliënt-id's** van toepassings wat **jou sal toelaat om met Azure te verbind**:
```powershell
# The important part is the ClientId, which identifies the application to login inside Azure
$token = Invoke-Authorize -Credential $credential `
-ClientId '1dfb5f98-f363-4b0f-b63a-8d20ada1e62d' `
-Scope 'Files.Read.All openid profile Sites.Read.All User.Read email' `
-Redirect_Uri "https://graphtryit-staging.azurewebsites.net/" `
-Verbose -Debug `
-InformationAction Continue
-ClientId '1dfb5f98-f363-4b0f-b63a-8d20ada1e62d' `
-Scope 'Files.Read.All openid profile Sites.Read.All User.Read email' `
-Redirect_Uri "https://graphtryit-staging.azurewebsites.net/" `
-Verbose -Debug `
-InformationAction Continue
$token = Invoke-Authorize -Credential $credential `
-ClientId '65611c08-af8c-46fc-ad20-1888eb1b70d9' `
-Scope 'openid profile Sites.Read.All User.Read email' `
-Redirect_Uri "chrome-extension://imjekgehfljppdblckcmjggcoboemlah" `
-Verbose -Debug `
-InformationAction Continue
-ClientId '65611c08-af8c-46fc-ad20-1888eb1b70d9' `
-Scope 'openid profile Sites.Read.All User.Read email' `
-Redirect_Uri "chrome-extension://imjekgehfljppdblckcmjggcoboemlah" `
-Verbose -Debug `
-InformationAction Continue
$token = Invoke-Authorize -Credential $credential `
-ClientId 'd3ce4cf8-6810-442d-b42e-375e14710095' `
-Scope 'openid' `
-Redirect_Uri "https://graphexplorer.azurewebsites.net/" `
-Verbose -Debug `
-InformationAction Continue
-ClientId 'd3ce4cf8-6810-442d-b42e-375e14710095' `
-Scope 'openid' `
-Redirect_Uri "https://graphexplorer.azurewebsites.net/" `
-Verbose -Debug `
-InformationAction Continue
```
### Tenants
### Huurders
{{#tabs }}
{{#tab name="az cli" }}
```bash
# List tenants
az account tenant list
```
{{#endtab }}
{{#endtabs }}
### Users
### Gebruikers
For more information about Entra ID users check:
Vir meer inligting oor Entra ID gebruikers, kyk:
{{#ref}}
../az-basic-information/
@@ -215,7 +199,6 @@ For more information about Entra ID users check:
{{#tabs }}
{{#tab name="az cli" }}
```bash
# Enumerate users
az ad user list --output table
@@ -245,7 +228,7 @@ az role assignment list --include-inherited --include-groups --include-classic-a
export TOKEN=$(az account get-access-token --resource https://graph.microsoft.com/ --query accessToken -o tsv)
## Get users
curl -X GET "https://graph.microsoft.com/v1.0/users" \
-H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" | jq
-H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" | jq
## Get EntraID roles assigned to an user
curl -X GET "https://graph.microsoft.com/beta/rolemanagement/directory/transitiveRoleAssignments?\$count=true&\$filter=principalId%20eq%20'86b10631-ff01-4e73-a031-29e505565caa'" \
-H "Authorization: Bearer $TOKEN" \
@@ -256,11 +239,9 @@ curl -X GET "https://graph.microsoft.com/beta/roleManagement/directory/roleDefin
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" | jq
```
{{#endtab }}
{{#tab name="Azure AD" }}
```powershell
# Enumerate Users
Get-AzureADUser -All $true
@@ -296,11 +277,9 @@ Get-AzureADUser -ObjectId roygcain@defcorphq.onmicrosoft.com | Get-AzureADUserAp
$userObj = Get-AzureADUser -Filter "UserPrincipalName eq 'bill@example.com'"
Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where { $_.Id -eq $userObj.ObjectId } }
```
{{#endtab }}
{{#tab name="Az PowerShell" }}
```powershell
# Enumerate users
Get-AzADUser
@@ -312,29 +291,26 @@ Get-AzADUser | ?{$_.Displayname -match "admin"}
# Get roles assigned to a user
Get-AzRoleAssignment -SignInName test@corp.onmicrosoft.com
```
{{#endtab }}
{{#endtabs }}
#### Change User Password
#### Verander Gebruiker Wagwoord
```powershell
$password = "ThisIsTheNewPassword.!123" | ConvertTo- SecureString -AsPlainText –Force
(Get-AzureADUser -All $true | ?{$_.UserPrincipalName -eq "victim@corp.onmicrosoft.com"}).ObjectId | Set- AzureADUserPassword -Password $password –Verbose
```
### MFA & Voorwaardelike Toegang Beleide
### MFA & Conditional Access Policies
It's highly recommended to add MFA to every user, however, some companies won't set it or might set it with a Conditional Access: The user will be **required MFA if** it logs in from an specific location, browser or **some condition**. These policies, if not configured correctly might be prone to **bypasses**. Check:
Dit word sterk aanbeveel om MFA aan elke gebruiker toe te voeg, egter, sommige maatskappye sal dit nie instel nie of mag dit instel met 'n Voorwaardelike Toegang: Die gebruiker sal **MFA vereis word as** dit vanaf 'n spesifieke ligging, blaaier of **sekere voorwaarde** aanmeld. Hierdie beleide, indien nie korrek geconfigureer nie, mag vatbaar wees vir **omseilings**. Kontroleer:
{{#ref}}
../az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md
{{#endref}}
### Groups
### Groepe
For more information about Entra ID groups check:
Vir meer inligting oor Entra ID groepe, kyk:
{{#ref}}
../az-basic-information/
@@ -342,7 +318,6 @@ For more information about Entra ID groups check:
{{#tabs }}
{{#tab name="az cli" }}
```powershell
# Enumerate groups
az ad group list
@@ -369,11 +344,9 @@ az role assignment list --include-groups --include-classic-administrators true -
# To get Entra ID roles assigned check how it's done with users and use a group ID
```
{{#endtab }}
{{#tab name="Azure AD" }}
```powershell
# Enumerate Groups
Get-AzureADGroup -All $true
@@ -399,11 +372,9 @@ Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember
# Get Apps where a group has a role (role not shown)
Get-AzureADGroup -ObjectId <id> | Get-AzureADGroupAppRoleAssignment | fl *
```
{{#endtab }}
{{#tab name="Az PowerShell" }}
```powershell
# Get all groups
Get-AzADGroup
@@ -417,29 +388,26 @@ Get-AzADGroupMember -GroupDisplayName <resource_group_name>
# Get roles of group
Get-AzRoleAssignment -ResourceGroupName <resource_group_name>
```
{{#endtab }}
{{#endtabs }}
#### Add user to group
Owners of the group can add new users to the group
#### Voeg gebruiker by groep
Eienaars van die groep kan nuwe gebruikers by die groep voeg
```powershell
Add-AzureADGroupMember -ObjectId <group_id> -RefObjectId <user_id> -Verbose
```
> [!WARNING]
> Groups can be dynamic, which basically means that **if a user fulfil certain conditions it will be added to a group**. Of course, if the conditions are based in **attributes** a **user** can **control**, he could abuse this feature to **get inside other groups**.\
> Check how to abuse dynamic groups in the following page:
> Groepe kan dinamies wees, wat basies beteken dat **as 'n gebruiker aan sekere voorwaardes voldoen, sal hy by 'n groep gevoeg word**. Natuurlik, as die voorwaardes gebaseer is op **atribute** wat 'n **gebruiker** kan **beheer**, kan hy hierdie funksie misbruik om **in ander groepe te kom**.\
> Kyk hoe om dinamiese groepe te misbruik op die volgende bladsy:
{{#ref}}
../az-privilege-escalation/az-entraid-privesc/dynamic-groups.md
{{#endref}}
### Service Principals
### Diens Principals
For more information about Entra ID service principals check:
Vir meer inligting oor Entra ID diens principals, kyk:
{{#ref}}
../az-basic-information/
@@ -447,7 +415,6 @@ For more information about Entra ID service principals check:
{{#tabs }}
{{#tab name="az cli" }}
```bash
# Get Service Principals
az ad sp list --all
@@ -464,11 +431,9 @@ az ad sp list --show-mine
# Get SPs with generated secret or certificate
az ad sp list --query '[?length(keyCredentials) > `0` || length(passwordCredentials) > `0`].[displayName, appId, keyCredentials, passwordCredentials]' -o json
```
{{#endtab }}
{{#tab name="Azure AD" }}
```powershell
# Get Service Principals
Get-AzureADServicePrincipal -All $true
@@ -487,11 +452,9 @@ Get-AzureADServicePrincipal -ObjectId <id> | Get-AzureADServicePrincipalCreatedO
Get-AzureADServicePrincipal | Get-AzureADServicePrincipalMembership
Get-AzureADServicePrincipal -ObjectId <id> | Get-AzureADServicePrincipalMembership |fl *
```
{{#endtab }}
{{#tab name="Az PowerShell" }}
```powershell
# Get SPs
Get-AzADServicePrincipal
@@ -502,155 +465,149 @@ Get-AzADServicePrincipal | ?{$_.DisplayName -match "app"}
# Get roles of a SP
Get-AzRoleAssignment -ServicePrincipalName <String>
```
{{#endtab }}
{{#tab name="Raw" }}
```powershell
$Token = 'eyJ0eX..'
$URI = 'https://graph.microsoft.com/v1.0/applications'
$RequestParams = @{
Method = 'GET'
Uri = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
Method = 'GET'
Uri = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
}
(Invoke-RestMethod @RequestParams).value
```
{{#endtab }}
{{#endtabs }}
> [!WARNING]
> The Owner of a Service Principal can change its password.
> Die eienaar van 'n dienshoof kan sy wagwoord verander.
<details>
<summary>List and try to add a client secret on each Enterprise App</summary>
<summary>lys en probeer om 'n kliëntsekrte op elke ondernemingstoepassing by te voeg</summary>
```powershell
# Just call Add-AzADAppSecret
Function Add-AzADAppSecret
{
<#
.SYNOPSIS
Add client secret to the applications.
.SYNOPSIS
Add client secret to the applications.
.PARAMETER GraphToken
Pass the Graph API Token
.PARAMETER GraphToken
Pass the Graph API Token
.EXAMPLE
PS C:\> Add-AzADAppSecret -GraphToken 'eyJ0eX..'
.EXAMPLE
PS C:\> Add-AzADAppSecret -GraphToken 'eyJ0eX..'
.LINK
https://docs.microsoft.com/en-us/graph/api/application-list?view=graph-rest-1.0&tabs=http
https://docs.microsoft.com/en-us/graph/api/application-addpassword?view=graph-rest-1.0&tabs=http
.LINK
https://docs.microsoft.com/en-us/graph/api/application-list?view=graph-rest-1.0&tabs=http
https://docs.microsoft.com/en-us/graph/api/application-addpassword?view=graph-rest-1.0&tabs=http
#>
[CmdletBinding()]
param(
[Parameter(Mandatory=$True)]
[String]
$GraphToken = $null
)
[CmdletBinding()]
param(
[Parameter(Mandatory=$True)]
[String]
$GraphToken = $null
)
$AppList = $null
$AppPassword = $null
$AppList = $null
$AppPassword = $null
# List All the Applications
# List All the Applications
$Params = @{
"URI" = "https://graph.microsoft.com/v1.0/applications"
"Method" = "GET"
"Headers" = @{
"Content-Type" = "application/json"
"Authorization" = "Bearer $GraphToken"
}
}
$Params = @{
"URI" = "https://graph.microsoft.com/v1.0/applications"
"Method" = "GET"
"Headers" = @{
"Content-Type" = "application/json"
"Authorization" = "Bearer $GraphToken"
}
}
try
{
$AppList = Invoke-RestMethod @Params -UseBasicParsing
}
catch
{
}
try
{
$AppList = Invoke-RestMethod @Params -UseBasicParsing
}
catch
{
}
# Add Password in the Application
# Add Password in the Application
if($AppList -ne $null)
{
[System.Collections.ArrayList]$Details = @()
if($AppList -ne $null)
{
[System.Collections.ArrayList]$Details = @()
foreach($App in $AppList.value)
{
$ID = $App.ID
$psobj = New-Object PSObject
foreach($App in $AppList.value)
{
$ID = $App.ID
$psobj = New-Object PSObject
$Params = @{
"URI" = "https://graph.microsoft.com/v1.0/applications/$ID/addPassword"
"Method" = "POST"
"Headers" = @{
"Content-Type" = "application/json"
"Authorization" = "Bearer $GraphToken"
}
}
$Params = @{
"URI" = "https://graph.microsoft.com/v1.0/applications/$ID/addPassword"
"Method" = "POST"
"Headers" = @{
"Content-Type" = "application/json"
"Authorization" = "Bearer $GraphToken"
}
}
$Body = @{
"passwordCredential"= @{
"displayName" = "Password"
}
}
$Body = @{
"passwordCredential"= @{
"displayName" = "Password"
}
}
try
{
$AppPassword = Invoke-RestMethod @Params -UseBasicParsing -Body ($Body | ConvertTo-Json)
Add-Member -InputObject $psobj -NotePropertyName "Object ID" -NotePropertyValue $ID
Add-Member -InputObject $psobj -NotePropertyName "App ID" -NotePropertyValue $App.appId
Add-Member -InputObject $psobj -NotePropertyName "App Name" -NotePropertyValue $App.displayName
Add-Member -InputObject $psobj -NotePropertyName "Key ID" -NotePropertyValue $AppPassword.keyId
Add-Member -InputObject $psobj -NotePropertyName "Secret" -NotePropertyValue $AppPassword.secretText
$Details.Add($psobj) | Out-Null
}
catch
{
Write-Output "Failed to add new client secret to '$($App.displayName)' Application."
}
}
if($Details -ne $null)
{
Write-Output ""
Write-Output "Client secret added to : "
Write-Output $Details | fl *
}
}
else
{
Write-Output "Failed to Enumerate the Applications."
}
try
{
$AppPassword = Invoke-RestMethod @Params -UseBasicParsing -Body ($Body | ConvertTo-Json)
Add-Member -InputObject $psobj -NotePropertyName "Object ID" -NotePropertyValue $ID
Add-Member -InputObject $psobj -NotePropertyName "App ID" -NotePropertyValue $App.appId
Add-Member -InputObject $psobj -NotePropertyName "App Name" -NotePropertyValue $App.displayName
Add-Member -InputObject $psobj -NotePropertyName "Key ID" -NotePropertyValue $AppPassword.keyId
Add-Member -InputObject $psobj -NotePropertyName "Secret" -NotePropertyValue $AppPassword.secretText
$Details.Add($psobj) | Out-Null
}
catch
{
Write-Output "Failed to add new client secret to '$($App.displayName)' Application."
}
}
if($Details -ne $null)
{
Write-Output ""
Write-Output "Client secret added to : "
Write-Output $Details | fl *
}
}
else
{
Write-Output "Failed to Enumerate the Applications."
}
}
```
</details>
### Applications
### Toepassings
For more information about Applications check:
Vir meer inligting oor Toepassings, kyk:
{{#ref}}
../az-basic-information/
{{#endref}}
When an App is generated 2 types of permissions are given:
Wanneer 'n App gegenereer word, word 2 tipes toestemmings gegee:
- **Permissions** given to the **Service Principal**
- **Permissions** the **app** can have and use on **behalf of the user**.
- **Toestemmings** gegee aan die **Diens Prinsipaal**
- **Toestemmings** wat die **app** kan hê en gebruik op **naam van die gebruiker**.
{{#tabs }}
{{#tab name="az cli" }}
```bash
# List Apps
az ad app list
@@ -666,11 +623,9 @@ az ad app list --show-mine
# Get apps with generated secret or certificate
az ad app list --query '[?length(keyCredentials) > `0` || length(passwordCredentials) > `0`].[displayName, appId, keyCredentials, passwordCredentials]' -o json
```
{{#endtab }}
{{#tab name="Azure AD" }}
```powershell
# List all registered applications
Get-AzureADApplication -All $true
@@ -681,11 +636,9 @@ Get-AzureADApplication -All $true | %{if(Get-AzureADApplicationPasswordCredentia
# Get owner of an application
Get-AzureADApplication -ObjectId <id> | Get-AzureADApplicationOwner |fl *
```
{{#endtab }}
{{#tab name="Az PowerShell" }}
```powershell
# Get Apps
Get-AzADApplication
@@ -696,26 +649,25 @@ Get-AzADApplication | ?{$_.DisplayName -match "app"}
# Get Apps with password
Get-AzADAppCredential
```
{{#endtab }}
{{#endtabs }}
> [!WARNING]
> An app with the permission **`AppRoleAssignment.ReadWrite`** can **escalate to Global Admin** by grating itself the role.\
> For more information [**check this**](https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48).
> 'n App met die toestemming **`AppRoleAssignment.ReadWrite`** kan **eskaleer na Global Admin** deur homself die rol toe te ken.\
> Vir meer inligting [**kyk hier**](https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48).
> [!NOTE]
> A secret string that the application uses to prove its identity when requesting a token is the application password.\
> So, if find this **password** you can access as the **service principal** **inside** the **tenant**.\
> Note that this password is only visible when generated (you could change it but you cannot get it again).\
> The **owner** of the **application** can **add a password** to it (so he can impersonate it).\
> Logins as these service principals are **not marked as risky** and they **won't have MFA.**
> 'n Geheime string wat die toepassing gebruik om sy identiteit te bewys wanneer dit 'n token aan vra, is die toepassingswagwoord.\
> So, as jy hierdie **wagwoord** vind, kan jy toegang verkry as die **dienshoof** **binne** die **huurder**.\
> Let daarop dat hierdie wagwoord slegs sigbaar is wanneer dit gegenereer word (jy kan dit verander, maar jy kan dit nie weer kry nie).\
> Die **eienaar** van die **toepassing** kan 'n **wagwoord** daaraan **byvoeg** (sodat hy dit kan naboots).\
> Aanmeldings as hierdie dienshoofde is **nie as riskant gemerk nie** en hulle **sal nie MFA hê nie.**
It's possible to find a list of commonly used App IDs that belongs to Microsoft in [https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications](https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications)
Dit is moontlik om 'n lys van algemeen gebruikte App ID's wat aan Microsoft behoort te vind in [https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications](https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications)
### Managed Identities
### Gemanagte Identiteite
For more information about Managed Identities check:
Vir meer inligting oor Gemanagte Identiteite, kyk:
{{#ref}}
../az-basic-information/
@@ -723,19 +675,17 @@ For more information about Managed Identities check:
{{#tabs }}
{{#tab name="az cli" }}
```bash
# List all manged identities
az identity list --output table
# With the principal ID you can continue the enumeration in service principals
```
{{#endtab }}
{{#endtabs }}
### Azure Roles
### Azure Rolle
For more information about Azure roles check:
Vir meer inligting oor Azure rolle, kyk:
{{#ref}}
../az-basic-information/
@@ -743,7 +693,6 @@ For more information about Azure roles check:
{{#tabs }}
{{#tab name="az cli" }}
```bash
# Get roles
az role definition list
@@ -765,11 +714,9 @@ az role assignment list --assignee "<email>" --all --output table
# Get all the roles assigned to a user by filtering
az role assignment list --all --query "[?principalName=='carlos@carloshacktricks.onmicrosoft.com']" --output table
```
{{#endtab }}
{{#tab name="Az PowerShell" }}
```powershell
# Get role assignments on the subscription
Get-AzRoleDefinition
@@ -779,31 +726,28 @@ Get-AzRoleDefinition -Name "Virtual Machine Command Executor"
Get-AzRoleAssignment -SignInName test@corp.onmicrosoft.com
Get-AzRoleAssignment -Scope /subscriptions/<subscription-id>/resourceGroups/<res_group_name>/providers/Microsoft.Compute/virtualMachines/<vm_name>
```
{{#endtab }}
{{#tab name="Raw" }}
```powershell
# Get permissions over a resource using ARM directly
$Token = (Get-AzAccessToken).Token
$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-d52d5d388768/resourceGroups/Research/providers/Microsoft.Compute/virtualMachines/infradminsrv/providers/Microsoft.Authorization/permissions?api-version=2015-07-01'
$RequestParams = @{
Method = 'GET'
Uri = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
Method = 'GET'
Uri = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
}
(Invoke-RestMethod @RequestParams).value
```
{{#endtab }}
{{#endtabs }}
### Entra ID Roles
### Entra ID Rolle
For more information about Azure roles check:
Vir meer inligting oor Azure rolle, kyk:
{{#ref}}
../az-basic-information/
@@ -811,55 +755,52 @@ For more information about Azure roles check:
{{#tabs }}
{{#tab name="az cli" }}
```bash
# List template Entra ID roles
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/directoryRoleTemplates"
--uri "https://graph.microsoft.com/v1.0/directoryRoleTemplates"
# List enabled built-in Entra ID roles
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/directoryRoles"
--uri "https://graph.microsoft.com/v1.0/directoryRoles"
# List all Entra ID roles with their permissions (including custom roles)
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions"
--uri "https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions"
# List only custom Entra ID roles
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions" | jq '.value[] | select(.isBuiltIn == false)'
--uri "https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions" | jq '.value[] | select(.isBuiltIn == false)'
# List all assigned Entra ID roles
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments"
--uri "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments"
# List members of a Entra ID roles
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/directoryRoles/<role-id>/members"
--uri "https://graph.microsoft.com/v1.0/directoryRoles/<role-id>/members"
# List Entra ID roles assigned to a user
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/users/<user-id>/memberOf/microsoft.graph.directoryRole" \
--query "value[]" \
--output json
--uri "https://graph.microsoft.com/v1.0/users/<user-id>/memberOf/microsoft.graph.directoryRole" \
--query "value[]" \
--output json
# List Entra ID roles assigned to a group
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/groups/$GROUP_ID/memberOf/microsoft.graph.directoryRole" \
--query "value[]" \
--output json
--uri "https://graph.microsoft.com/v1.0/groups/$GROUP_ID/memberOf/microsoft.graph.directoryRole" \
--query "value[]" \
--output json
# List Entra ID roles assigned to a service principal
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/servicePrincipals/$SP_ID/memberOf/microsoft.graph.directoryRole" \
--query "value[]" \
--output json
--uri "https://graph.microsoft.com/v1.0/servicePrincipals/$SP_ID/memberOf/microsoft.graph.directoryRole" \
--query "value[]" \
--output json
```
{{#endtab }}
{{#tab name="Azure AD" }}
```powershell
# Get all available role templates
Get-AzureADDirectoryroleTemplate
@@ -874,23 +815,19 @@ Get-AzureADDirectoryRole -ObjectId <id> | fl
# Roles of the Administrative Unit (who has permissions over the administrative unit and its members)
Get-AzureADMSScopedRoleMembership -Id <id> | fl *
```
{{#endtab }}
{{#endtabs }}
### Devices
### Toestelle
{{#tabs }}
{{#tab name="az cli" }}
```bash
# If you know how to do this send a PR!
```
{{#endtab }}
{{#tab name="Azure AD" }}
```powershell
# Enumerate Devices
Get-AzureADDevice -All $true | fl *
@@ -909,17 +846,16 @@ Get-AzureADUserOwnedDevice -ObjectId test@corp.onmicrosoft.com
# Get Administrative Units of a device
Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -ObjectId $_.ObjectId | where {$_.ObjectId -eq $deviceObjId} }
```
{{#endtab }}
{{#endtabs }}
> [!WARNING]
> If a device (VM) is **AzureAD joined**, users from AzureAD are going to be **able to login**.\
> Moreover, if the logged user is **Owner** of the device, he is going to be **local admin**.
> As 'n toestel (VM) **AzureAD-verbonden** is, gaan gebruikers van AzureAD **in staat wees om aan te meld**.\
> Boonop, as die aangemelde gebruiker die **Eienaar** van die toestel is, gaan hy **lokale admin** wees.
### Administrative Units
### Administratiewe Eenhede
For more information about administrative units check:
Vir meer inligting oor administratiewe eenhede, kyk:
{{#ref}}
../az-basic-information/
@@ -927,7 +863,6 @@ For more information about administrative units check:
{{#tabs }}
{{#tab name="az cli" }}
```bash
# List all administrative units
az rest --method GET --uri "https://graph.microsoft.com/v1.0/directory/administrativeUnits"
@@ -938,11 +873,9 @@ az rest --method GET --uri "https://graph.microsoft.com/v1.0/directory/administr
# Get principals with roles over the AU
az rest --method GET --uri "https://graph.microsoft.com/v1.0/directory/administrativeUnits/a76fd255-3e5e-405b-811b-da85c715ff53/scopedRoleMembers"
```
{{#endtab }}
{{#tab name="AzureAD" }}
```powershell
# Get Administrative Units
Get-AzureADMSAdministrativeUnit
@@ -954,7 +887,6 @@ Get-AzureADMSAdministrativeUnitMember -Id <id>
# Get the roles users have over the members of the AU
Get-AzureADMSScopedRoleMembership -Id <id> | fl #Get role ID and role members
```
{{#endtab }}
{{#endtabs }}
@@ -970,66 +902,62 @@ Get-AzureADMSScopedRoleMembership -Id <id> | fl #Get role ID and role members
../az-privilege-escalation/az-authorization-privesc.md
{{#endref}}
## Defensive Mechanisms
## Verdedigingsmeganismes
### Privileged Identity Management (PIM)
Privileged Identity Management (PIM) in Azure helps to **prevent excessive privileges** to being assigned to users unnecessarily.
Privileged Identity Management (PIM) in Azure help om **oormatige bevoegdhede** aan gebruikers onnodig toe te ken.
One of the main features provided by PIM is that It allows to not assign roles to principals that are constantly active, but make them **eligible for a period of time (e.g. 6months)**. Then, whenever the user wants to activate that role, he needs to ask for it indicating the time he needs the privilege (e.g. 3 hours). Then an **admin needs to approve** the request.\
Note that the user will also be able to ask to **extend** the time.
Een van die hoofkenmerke wat deur PIM verskaf word, is dat dit toelaat om nie rolle aan principals toe te ken wat konstant aktief is nie, maar hulle **verkieslik te maak vir 'n tydperk (bv. 6 maande)**. Dan, wanneer die gebruiker daardie rol wil aktiveer, moet hy daarvoor vra en die tyd aan dui wat hy die bevoegdheid benodig (bv. 3 ure). Dan moet 'n **admin die versoek goedkeur**.\
Let daarop dat die gebruiker ook kan vra om die tyd te **verleng**.
Moreover, **PIM send emails** whenever a privileged role is being assigned to someone.
Boonop **stuur PIM e-posse** wanneer 'n bevoorregte rol aan iemand toegeken word.
<figure><img src="../../../images/image (354).png" alt=""><figcaption></figcaption></figure>
When PIM is enabled it's possible to configure each role with certain requirements like:
Wanneer PIM geaktiveer is, is dit moontlik om elke rol met sekere vereistes te konfigureer soos:
- Maximum duration (hours) of activation
- Require MFA on activation
- Require Conditional Access acuthenticaiton context
- Require justification on activation
- Require ticket information on activation
- Require approval to activate
- Max time to expire the elegible assignments&#x20;
- A lot more configuration on when and who to send notifications when certain actions happen with that role
- Maksimum duur (ure) van aktivering
- Vereis MFA op aktivering
- Vereis voorwaardelike toegang autentikasie konteks
- Vereis regverdigings op aktivering
- Vereis kaartjie-inligting op aktivering
- Vereis goedkeuring om te aktiveer
- Maks tyd om die verkieslike toewysings te laat verval&#x20;
- Nog baie meer konfigurasie oor wanneer en aan wie om kennisgewings te stuur wanneer sekere aksies met daardie rol gebeur
### Conditional Access Policies <a href="#title-text" id="title-text"></a>
### Voorwaardelike Toegang Beleide <a href="#title-text" id="title-text"></a>
Check:
Kontroleer:
{{#ref}}
../az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md
{{#endref}}
### Entra Identity Protection <a href="#title-text" id="title-text"></a>
### Entra Identiteitsbeskerming <a href="#title-text" id="title-text"></a>
Entra Identity Protection is a security service that allows to **detect when a user or a sign-in is too risky** to be accepted, allowing to **block** the user or the sig-in attempt.
Entra Identiteitsbeskerming is 'n sekuriteitsdiens wat toelaat om **te detecteer wanneer 'n gebruiker of 'n aanmelding te riskant is** om aanvaar te word, wat toelaat om die gebruiker of die aanmeldpoging te **blokkeer**.
It allows the admin to configure it to **block** attempts when the risk is "Low and above", "Medium and above" or "High". Although, by default it's completely **disabled**:
Dit laat die admin toe om dit te konfigureer om **pogings te blokkeer** wanneer die risiko "Laag en bo", "Medium en bo" of "Hoog" is. Alhoewel, standaard is dit heeltemal **deaktiveer**:
<figure><img src="../../../images/image (356).png" alt=""><figcaption></figcaption></figure>
> [!TIP]
> Nowadays it's recommended to add these restrictions via Conditional Access policies where it's possible to configure the same options.
> Vandag word dit aanbeveel om hierdie beperkings via Voorwaardelike Toegang beleide toe te voeg waar dit moontlik is om dieselfde opsies te konfigureer.
### Entra Password Protection
### Entra Wagwoordbeskerming
Entra Password Protection ([https://portal.azure.com/#view/Microsoft_AAD_ConditionalAccess/PasswordProtectionBlade](https://portal.azure.com/#view/Microsoft_AAD_ConditionalAccess/PasswordProtectionBlade)) is a security feature that **helps prevent the abuse of weak passwords in by locking out accounts when several unsuccessful login attempts happen**.\
It also allows to **ban a custom password list** that you need to provide.
Entra Wagwoordbeskerming ([https://portal.azure.com/#view/Microsoft_AAD_ConditionalAccess/PasswordProtectionBlade](https://portal.azure.com/#view/Microsoft_AAD_ConditionalAccess/PasswordProtectionBlade)) is 'n sekuriteitskenmerk wat **help om die misbruik van swak wagwoorde te voorkom deur rekeninge te sluit wanneer verskeie onsuksesvolle aanmeldpogings plaasvind**.\
Dit laat ook toe om 'n **aangepaste wagwoordlys te verbied** wat jy moet verskaf.
It can be **applied both** at the cloud level and on-premises Active Directory.
Dit kan **op beide** die wolkvlak en op-premises Aktiewe Gids toegepas word.
The default mode is **Audit**:
Die standaardmodus is **Oudit**:
<figure><img src="../../../images/image (355).png" alt=""><figcaption></figcaption></figure>
## References
## Verwysings
- [https://learn.microsoft.com/en-us/azure/active-directory/roles/administrative-units](https://learn.microsoft.com/en-us/azure/active-directory/roles/administrative-units)
{{#include ../../../banners/hacktricks-training.md}}